Sprinto Cookbooks

Mark staff member account Not-In-Scope

Use the Sprinto Developer API to mark a staff member as not-in-scope and exclude them from audit and compliance checks.

This cookbook explains how to mark a staff member account as not-in-scope using the Sprinto Developer API.

When staff accounts are added to Sprinto through HRMS or email provider integrations, they are included in the audit scope by default. Marking a staff member as not-in-scope excludes them from compliance activities such as policy acknowledgements, training assignments, and automated checks.

This operation is performed using a GraphQL mutation.


Before you begin

Ensure that you have:

  • A valid API key
  • Access to the Sprinto API Playground (if using the playground)
  • The email address of the staff member to mark as not-in-scope

If the provided email address is invalid or does not belong to an active staff member, the API returns an error.


API status

The Sprinto Developer API is currently in beta.

  • Endpoints and schema fields may change as new functionality is introduced.

Mutation: markStaffAsNotInScope

This mutation marks a staff member as not-in-scope using their email address. You can optionally provide a reason for auditing or tracking purposes.

Input arguments

ArgumentTypeRequiredDescription
emailStringYesEmail address of the staff member to mark as not-in-scope
reasonStringNoOptional reason for marking the staff member as not-in-scope

Example mutation

mutation MarkStaffAsNotInScope($email: String!, $reason: String) {
  markStaffAsNotInScope(email: $email, reason: $reason) {
    user {
      fullName
    }
  }
}

Try yourself: United States: Europe: India


How the mutation works

  • The request starts with the Mutation root type.
  • The markStaffAsNotInScope mutation identifies the staff member using the email argument.
  • The optional reason argument records why the staff member is excluded from scope.
  • On success, the API returns the updated user object.

Response fields

You can request the following fields from the returned user object:

FieldTypeDescription
firstNameStringFirst name of the staff member
lastNameStringLast name of the staff member
fullNameStringFull name of the staff member
emailStringEmail address of the staff member

Response codes and errors

The following response codes may be returned for this mutation:

Status codeStatusMessageReason
200SuccessThe account is marked as not-in-scope.The staff member was successfully updated.
200ErrorInvalid email address or a non-staff account.The email does not belong to a valid staff account or is marked as non-staff.
200ErrorThe email was assigned to an offboarded staff member.Offboarded staff members cannot be marked as not-in-scope.
401UnauthorizedInvalid or expired API token.The API key is invalid or disabled.
429Too many requestsToo many requests. Please try again later.The API rate limit has been exceeded.

Next steps

After marking a staff member as not-in-scope, you can:

  • Review in-scope and not-in-scope staff using paginated queries
  • Re-include staff members by marking them in-scope
  • Automate staff scoping as part of onboarding and offboarding workflows